feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks: - run roles api/worker/job/all with shared startup checks (Task 1) - schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2) - audit, notifications and domain events written in the same transaction (Task 3) - dispatcher with SKIP LOCKED claims, retries and stale release (Task 4) - worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5) - worker process and entry points (Task 6) - throttler counters in Postgres (Task 19) - separate keys per purpose with key ring (Task 20) - public origin page without exact location (Task 22) - shop keys split into read and write (Task 23) - Kustomize base, components, overlay encry, CI validation (Task 26) Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks: - brood frames, read endpoints, apiary overview and offline pack - network basics, offline queue v3, navigation sheets, form building blocks - new inspection with last-time hints and weather, varroa per day, treatment prefill, apiary page with round - inspection photo (Task 10) is implemented, review pending Not rolled out. Remaining tasks follow in later commits. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-10-13 17:57:54 +02:00
1 parent 10cbe9bf2d
commit c01a38835a
@@ -0,0 +1,21 @@
+# Werte fuer den Cluster. Bedeutung der Schluessel:
+# base/backend/configmap.example.yaml. Hosts und Tenant sind Platzhalter,
+# Runbook Schritt 1 uebernimmt die Live-Werte. Geheimes gehoert ins Secret
+# apicore-backend-secret, nie hierher.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: apicore-backend-config
+data:
+  PORT: "3001"
+  JWT_ACCESS_EXPIRES_IN: "15m"
+  JWT_REFRESH_EXPIRES_IN: "7d"
+  FRONTEND_ORIGIN: "https://apicore.example.com"
+  DOCUMENTS_STORAGE_PATH: "/data/documents"
+  BACKUP_STORAGE_PATH: "/data/backups"
+  BACKUP_CRON_SCHEDULE: "0 3 * * *"
+  BACKUP_RETENTION_COUNT: "14"
+  COOKIE_SECURE: "true"
+  TRUST_PROXY: "loopback, 10.42.0.0/16, 173.245.48.0/20, 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 141.101.64.0/18, 108.162.192.0/18, 190.93.240.0/20, 188.114.96.0/20, 197.234.240.0/22, 198.41.128.0/17, 162.158.0.0/15, 104.16.0.0/13, 104.24.0.0/14, 172.64.0.0/13, 131.0.72.0/22, 2400:cb00::/32, 2606:4700::/32, 2803:f800::/32, 2405:b500::/32, 2405:8100::/32, 2a06:98c0::/29, 2c0f:f248::/32"
+  OIDC_ISSUER_URL: "https://login.microsoftonline.com/<tenant-id>/v2.0"
+  OIDC_REDIRECT_URI: "https://api.apicore.example.com/api/v1/auth/sso/callback"
@@ -0,0 +1,8 @@
+# Werte fuer den Cluster, Bedeutung: base/frontend/configmap.example.yaml.
+# Der Host ist ein Platzhalter, Runbook Schritt 1 uebernimmt den Live-Wert.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: apicore-frontend-config
+data:
+  API_URL: "https://api.apicore.example.com/api/v1"
@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: apicore-backend
+  annotations:
+    # Requires cert-manager with a ClusterIssuer named "letsencrypt-prod"
+    # (or swap for whatever issuer/cert mechanism the cluster already uses).
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Nur Traffic ueber Cloudflare zulassen. Die Middleware liegt im Repo
+    # rke2-cluster (security/cloudflare-only-middlewares.yaml). Sie schuetzt vor
+    # Direktzugriff am Origin vorbei, nicht vor fremden Cloudflare-Zonen.
+    traefik.ingress.kubernetes.io/router.middlewares: apicore-cloudflare-only@kubernetescrd
+spec:
+  # Der Cluster (RKE2) nutzt Traefik; nur damit wirkt die Middleware-Annotation oben.
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - api.apicore.example.com
+      secretName: apicore-backend-tls
+  rules:
+    - host: api.apicore.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: apicore-backend
+                port:
+                  number: 80
@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: apicore-frontend
+  annotations:
+    # Requires cert-manager with a ClusterIssuer named "letsencrypt-prod"
+    # (or swap for whatever issuer/cert mechanism the cluster already uses).
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Nur Traffic ueber Cloudflare zulassen. Die Middleware liegt im Repo
+    # rke2-cluster (security/cloudflare-only-middlewares.yaml). Sie schuetzt vor
+    # Direktzugriff am Origin vorbei, nicht vor fremden Cloudflare-Zonen.
+    traefik.ingress.kubernetes.io/router.middlewares: apicore-cloudflare-only@kubernetescrd
+spec:
+  # Der Cluster (RKE2) nutzt Traefik; nur damit wirkt die Middleware-Annotation oben.
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - apicore.example.com
+      secretName: apicore-frontend-tls
+  rules:
+    - host: apicore.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: apicore-frontend
+                port:
+                  number: 80
@@ -0,0 +1,51 @@
+# Overlay fuer den RKE2-Cluster von EnCry (Namespace apicore, Traefik mit
+# Middleware cloudflare-only). Vor jedem Rollout zeigt
+#   kubectl diff -k deploy/k8s/overlays/encry
+# was sich aendert; nach dem Rollout ist der Diff leer.
+#
+# Gewollte Platzhalter, nie so anwenden:
+# - Image-Digests sha256:000...: Runbook Schritt 0 traegt die Digests der
+#   CI-Builds (sha-<commit>) und von postgres:18.6-alpine ein.
+# - Hosts in ingress-*.yaml und Werte in configmap-*.yaml: Runbook Schritt 1
+#   uebernimmt sie aus dem Live-Stand.
+#
+# Backend-Digest: Das neue Image (CMD nur `node dist/main.js`) geht erst
+# zusammen mit components/backend-roles live (Runbook Schritt 3). Bis dahin
+# bleibt hier der Digest des laufenden Images. Ohne APICORE_ROLE bricht das
+# neue Image den Start in Produktion absichtlich ab. APICORE_ROLE nicht von
+# Hand setzen: ohne die initContainer von backend-roles liefe dann keine
+# Migration.
+#
+# Postgres: Bis 2026-10-13 wichen die Repo-Manifeste vom Cluster ab (Repo
+# app: apicore-postgres, ohne Haertung, volumeClaimTemplates; Cluster
+# app.kubernetes.io/name, gehaertet, statisches PVC apicore-postgres-data).
+# Seit 2026-10-13 ist base/postgres der Live-Stand (StatefulSet, Service,
+# PVC), nur das Image-Digest kommt von hier. Selektor und Volumes sind
+# unveraenderlich: Aenderungen an Postgres immer zuerst gegen den Cluster
+# pruefen (kubectl diff), nie die Live-Haertung zuruecknehmen. Das PV
+# pv-apicore-postgres und sein SMB-Secret liegen nicht in diesem Repo.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: apicore
+resources:
+  - ../../base
+  - configmap-backend.yaml
+  - configmap-frontend.yaml
+  - ingress-backend.yaml
+  - ingress-frontend.yaml
+# Zielstand. Je Runbook-Schritt nur die bis dahin freigegebenen Komponenten
+# aktivieren (Schritt 1: keine). Das Auskommentieren ist nur lokal fuer
+# kubectl diff/apply - nicht committen. Die CI rendert und prueft jeden
+# Schritt (deploy/k8s/tests/render-stages.mjs).
+components:
+  - ../../components/network-policies # Schritt 2
+  - ../../components/pod-hardening # Schritt 3
+  - ../../components/backend-roles # Schritt 3
+  - ../../components/api-hpa # Schritt 5
+images:
+  - name: git.encry.de/nick.rosenloecher/apicore-backend
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+  - name: git.encry.de/nick.rosenloecher/apicore-frontend
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+  - name: postgres
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000